about summary refs log tree commit diff
diff options
context:
space:
mode:
authorbors <bors@rust-lang.org>2024-06-01 12:24:44 +0000
committerbors <bors@rust-lang.org>2024-06-01 12:24:44 +0000
commitacaf0aeed0dfbfc4be9f996344e2c5f294cf5794 (patch)
treece4b494d9c7f2b8c5d43a7341278cca937d0ed84
parent05965ae238403d8c141170b411245a62aa046240 (diff)
parentd3c8e6788cfbcc64ab7710cab7a56e276e7d5a7a (diff)
downloadrust-acaf0aeed0dfbfc4be9f996344e2c5f294cf5794.tar.gz
rust-acaf0aeed0dfbfc4be9f996344e2c5f294cf5794.zip
Auto merge of #125821 - Luv-Ray:issue#121126, r=fee1-dead
Check index `value <= 0xFFFF_FF00`

<!--
If this PR is related to an unstable feature or an otherwise tracked effort,
please link to the relevant tracking issue here. If you don't know of a related
tracking issue or there are none, feel free to ignore this.

This PR will get automatically assigned to a reviewer. In case you would like
a specific user to review your work, you can assign it to them by using

    r​? <reviewer name>
-->
fixes #121126

check `idx <= FieldIdx::MAX_AS_U32` before calling `FieldIdx::from_u32` to avoid panic.
-rw-r--r--compiler/rustc_mir_transform/src/known_panics_lint.rs8
-rw-r--r--tests/crashes/121126.rs4
-rw-r--r--tests/ui/indexing/index-bounds.rs10
-rw-r--r--tests/ui/indexing/index-bounds.stderr16
4 files changed, 32 insertions, 6 deletions
diff --git a/compiler/rustc_mir_transform/src/known_panics_lint.rs b/compiler/rustc_mir_transform/src/known_panics_lint.rs
index 9ba22870403..8b46658b322 100644
--- a/compiler/rustc_mir_transform/src/known_panics_lint.rs
+++ b/compiler/rustc_mir_transform/src/known_panics_lint.rs
@@ -102,8 +102,12 @@ impl<'tcx> Value<'tcx> {
                 }
                 (PlaceElem::Index(idx), Value::Aggregate { fields, .. }) => {
                     let idx = prop.get_const(idx.into())?.immediate()?;
-                    let idx = prop.ecx.read_target_usize(idx).ok()?;
-                    fields.get(FieldIdx::from_u32(idx.try_into().ok()?)).unwrap_or(&Value::Uninit)
+                    let idx = prop.ecx.read_target_usize(idx).ok()?.try_into().ok()?;
+                    if idx <= FieldIdx::MAX_AS_U32 {
+                        fields.get(FieldIdx::from_u32(idx)).unwrap_or(&Value::Uninit)
+                    } else {
+                        return None;
+                    }
                 }
                 (
                     PlaceElem::ConstantIndex { offset, min_length: _, from_end: false },
diff --git a/tests/crashes/121126.rs b/tests/crashes/121126.rs
deleted file mode 100644
index 2ebe91f02de..00000000000
--- a/tests/crashes/121126.rs
+++ /dev/null
@@ -1,4 +0,0 @@
-//@ known-bug: #121126
-fn main() {
-    let _n = 1i64 >> [64][4_294_967_295];
-}
diff --git a/tests/ui/indexing/index-bounds.rs b/tests/ui/indexing/index-bounds.rs
new file mode 100644
index 00000000000..2b318beeeaa
--- /dev/null
+++ b/tests/ui/indexing/index-bounds.rs
@@ -0,0 +1,10 @@
+//@ build-fail
+
+fn main() {
+    let _n = [64][200];
+    //~^ ERROR this operation will panic at runtime [unconditional_panic]
+
+    // issue #121126, test index value between 0xFFFF_FF00 and u32::MAX
+    let _n = [64][u32::MAX as usize - 1];
+    //~^ ERROR this operation will panic at runtime [unconditional_panic]
+}
diff --git a/tests/ui/indexing/index-bounds.stderr b/tests/ui/indexing/index-bounds.stderr
new file mode 100644
index 00000000000..51d8c7567a4
--- /dev/null
+++ b/tests/ui/indexing/index-bounds.stderr
@@ -0,0 +1,16 @@
+error: this operation will panic at runtime
+  --> $DIR/index-bounds.rs:4:14
+   |
+LL |     let _n = [64][200];
+   |              ^^^^^^^^^ index out of bounds: the length is 1 but the index is 200
+   |
+   = note: `#[deny(unconditional_panic)]` on by default
+
+error: this operation will panic at runtime
+  --> $DIR/index-bounds.rs:8:14
+   |
+LL |     let _n = [64][u32::MAX as usize - 1];
+   |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^ index out of bounds: the length is 1 but the index is 4294967294
+
+error: aborting due to 2 previous errors
+